# The WAI quantum job service as an OCI image, for running it yourself.
#
# Build from the repository's wai/ directory, with the ignore file beside
# this one keeping the context to the two crates the service is built from:
#
#   docker build -f wai-quantum-service/deploy/Containerfile -t wai-quantum-service wai/
#   (or: podman build -f ... the same)
#
# Two stages. The first builds the service with the repository's pinned
# toolchain from the locked dependencies; the second holds the binary alone,
# run as an unprivileged user. Both bases are pinned by digest, the build is
# locked, paths are remapped and the timestamp is fixed, so the same source
# builds the same binary. See ../docs/self-host.md for running it.

# The build stage: the language's build image at the repository's toolchain, pinned by digest.
FROM docker.io/library/rust:1.98.0-slim-trixie@sha256:17d1ba895198f9934c6314ec5346a0d5115372f3243390c3d731e242f35c2f27 AS build
ENV CARGO_INCREMENTAL=0 \
    CARGO_TERM_COLOR=never \
    SOURCE_DATE_EPOCH=0 \
    RUSTFLAGS="--remap-path-prefix=/src=/build --remap-path-prefix=/usr/local/cargo=/cargo -C strip=symbols"
WORKDIR /src
COPY wai-quantum ./wai-quantum
COPY wai-quantum-service ./wai-quantum-service
WORKDIR /src/wai-quantum-service
# JOBS bounds the build's parallel jobs on a shared host (--build-arg JOBS=8).
ARG JOBS
RUN cargo build --locked --release ${JOBS:+--jobs "$JOBS"} && cp target/release/wai-quantum-service /wai-quantum-service

# The run stage: a slim base of the same release, pinned by digest, and the binary.
FROM docker.io/library/debian:trixie-slim@sha256:89c1ea91e897f0fe0a3731595330bc45b8bdef4047464a07116f891a94054b31
RUN useradd --system --uid 10001 --home-dir /var/lib/wai-quantum-service --create-home wai \
 && mkdir -p /var/lib/wai-quantum-service/store /var/lib/wai-quantum-service/keys \
 && chown -R wai:wai /var/lib/wai-quantum-service \
 && chmod 0700 /var/lib/wai-quantum-service/keys
COPY --from=build /wai-quantum-service /usr/local/bin/wai-quantum-service
USER wai
# Everything the service keeps lives under one volume: its job store and its receipt keys.
VOLUME ["/var/lib/wai-quantum-service"]
ENV WAI_QSVC_ADDR=0.0.0.0:8241 \
    WAI_QSVC_STORE=/var/lib/wai-quantum-service/store \
    WAI_QSVC_KEY=/var/lib/wai-quantum-service/keys/signing.key \
    WAI_QSVC_PUBLIC_BASE=http://localhost:8241 \
    WAI_QSVC_CONSOLE=http://localhost:8241/v1 \
    WAI_QSVC_BUDGET_GB=8 \
    WAI_QSVC_JOB_GB=4 \
    WAI_QSVC_WORKERS=2
EXPOSE 8241
ENTRYPOINT ["/usr/local/bin/wai-quantum-service"]
CMD ["serve"]